Audit logging

Who did what, where, when—and whether it worked.

Data Convoy keeps an append-only history of privileged mutations, denied attempts, worker lifecycle events, authentication, and selected sensitive reads.

Useful detail, not a request firehose

Events include a snapshotted actor label, team visibility scope, action, target, method, path, outcome, network context, and redacted action metadata. High-frequency polling and worker heartbeats are intentionally excluded.

Logs outlive the records they describe

Audit actor and team identifiers are not foreign-key cascaded. Deleting a user or team does not erase the record of the action that caused it.

Archive before delete

Retention maintenance writes old events as NDJSON to the customer’s own log bucket before removing the database rows. Verbose worker logs use the same customer-owned storage path and can be viewed from the job detail page.

Your buckets. Your workers. Your control.

Make the next archive reversible.